Conversation
…loyments Add an opt-in DIGGER_UI_AUTH_MODE=static that runs the UI as one fixed identity (DIGGER_STATIC_* env) without calling WorkOS, for self-hosted single-tenant deployments where access is already controlled in front of the UI (network perimeter, VPN, or an authenticating reverse proxy). No WORKOS_* env is required in this mode. Default behavior is unchanged: unset (or any other value) keeps WorkOS auth as-is. - withAuth() returns the static identity in static mode, and now has an explicit UserInfo | NoUserInfo return type so the union typechecks - getOrganisationDetails/getOrganization/ensureOrgExists return a static organisation instead of the WorkOS org lookup; terminateSession redirects home instead of building a WorkOS logout URL - the DIGGER_ORG_SOURCE header sent to the backend is env-configurable (default workos, unchanged) so orgs created outside WorkOS (e.g. the GitHub OAuth path) can resolve - document the mode in self-hosting/configuration.mdx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The UI hard-requires WorkOS: without
WORKOS_*env vars it cannot authenticate anyone, which is a hurdle for self-hosted single-tenant deployments that already control access in front of the UI (network perimeter, VPN, or an authenticating reverse proxy). Related friction exists for any deployment whose backend organisation wasn't created through WorkOS (e.g. the GitHub OAuth path) — the UI's hardcodedDIGGER_ORG_SOURCE: workosheader can't resolve such orgs.Change (fully opt-in — default behavior unchanged)
DIGGER_UI_AUTH_MODE=staticmode:withAuth()returns a fixed identity fromDIGGER_STATIC_*env vars and WorkOS is never called — noWORKOS_*env is needed to boot. Unset (or any other value) keeps WorkOS auth exactly as today.getOrganisationDetails/getOrganization/ensureOrgExistsreturn a static organisation (DIGGER_STATIC_ORG_NAME) in static mode instead of the WorkOS org lookup;terminateSessionredirects home instead of building a WorkOS logout URL.DIGGER_ORG_SOURCEheader sent to the backend is now env-configurable (defaultworkos, unchanged), so deployments whose org has a different external source can resolve it.withAuth()now has an explicitPromise<UserInfo | NoUserInfo>return type (required for the widened union to typecheck; also tightens the existing inference).DIGGER_STATIC_ORG_IDis required in static mode and fails loudly with a clear message if missing.self-hosting/configuration.mdx.Testing
vite build+tsc --noEmitclean.Happy to rename the env vars / adjust the flag shape if maintainers prefer a different convention.
🧠 Ai UsageDetails (if applicable):
Per the contributing guide: implemented with AI assistance (Claude Code) in our production fork, then human-reviewed and production-validated before being generalized (opt-in flag, neutral defaults) for upstream.